Skip to content
    Back to homeעברית

    Privacy Policy

    Last updated:

    GameTrust is a product of RedRock Studio, an independent digital product studio based in Eilat, Israel, owned by Roni Ran Sror ("we", "us").

    This policy explains what information we collect through gametrust.work and the GameTrust apps (the "Service"), why, who we share it with, how long we keep it, and how you can access, correct or delete it.

    GameTrust is meant for parents. Children do not sign up on their own — parents create a profile for each child and control it.

    1. Who is responsible for your data

    The controller of the Service's database is RedRock Studio:

    • Business: RedRock Studio, an independent digital product studio based in Eilat, Israel
    • Owner: Roni Ran Sror
    • Address: Ein Gedi 32/1, Eilat, Israel
    • Phone / WhatsApp: +972504737763
    • Email: office@redrockstudio.net
    • The business registration number appears on quotes and invoices sent to customers.

    Privacy requests: office@redrockstudio.net

    Data protection officer: Given the scale of the activity and the nature of the data processed, there is no obligation to appoint a data protection officer.

    2. What we collect

    About parents

    • Account details: email and password (the password is kept, hashed, by our authentication provider and is never visible to us), or Sign in with Google or Apple — in which case we receive your name and email from them (with Apple this may be a relay address).
    • Display name: the name on your Google/Apple account, or the first part of your email address.
    • Family details: family name, number of children, the family PIN (the code children sign in with), the family language and time zone, and any co-parents who joined.
    • How you heard about us: your answer to the question shown during family setup.
    • Sign-up source: the campaign tags in the link that brought you (UTM), ad click identifiers (such as fbclid, gclid, ttclid), the landing page, your browser language and time zone, and how you signed up.
    • Consent record: the versions of the Terms of Use and Privacy Policy you accepted, when, and the IP address it was sent from.
    • Content you create: missions, rewards, approvals and send-backs, and messages to your children.
    • Notifications: if you allow notifications — the device push token, a short description of the device or browser, your time zone and language.
    • Messages to us: the content of any correspondence with us.

    About children

    Most information about children is entered by their parents; some is created as the children use the Service.

    • Nickname: any name the parents choose — a real name is not needed. The child can update the nickname on first sign-in.
    • Exact age: in years (not a date of birth), to keep missions and rewards age-appropriate.
    • Gaming platforms (e.g. PlayStation, Xbox, Switch, PC, phone), the first prize the parents set, and profile settings: country, language and time zone.
    • Avatar: a choice of ready-made items (head, outfit, accessory). No face photo is uploaded for the avatar.
    • Mission activity: missions submitted, approvals, points, Gems, levels, streaks, the daily gift and rewards redeemed.
    • Mission proof (optional): photos (up to 5 per mission), voice recordings and text notes the child attaches. A mission can be marked done without any proof.
    • Sign-in and usage: the invite code or magic link the child signs in with, temporary sign-in tokens, and basic usage events in the child app (sign-in, screen views, mission submission) together with a browser or device description.
    • Notifications: if notifications are allowed on the child’s device — its push token, language and time zone.

    Waitlist

    If you joined the waitlist on our landing page: email, name, your children’s age range, language and time zone, campaign tags, and a one-way hash of your IP address — not the address itself.

    Technical information

    • IP addresses: of failed family-PIN sign-in attempts (to stop code guessing), and of your acceptance of the terms (see above).
    • Error reports: when something fails, a technical report goes to our error-monitoring service. When a parent is signed in, it includes the account id and email address.
    • Usage data: through cookies and measurement tools — see "Cookies and measurement".

    What we do not collect

    We do not collect location, contacts, ID numbers or payment details, and we do not use photos or voice recordings to identify anyone.

    3. How we use it

    • Running the Service: managing the family, missions, points, Gems and rewards, and showing proof to parents for approval.
    • Sign-in and security: identifying parents, letting children sign in with a code or link, limiting code-guessing attempts and preventing abuse.
    • Service messages: notifications and emails about activity in your family — for example a mission waiting for approval, a reminder that a child has not signed in yet, or a welcome message.
    • Mission and reward ideas (Mission Lab, Reward ideas) and reminder wording: when you ask for ideas, the child’s nickname and age and your request are sent to the provider that writes the text. For worded reminders, nicknames, the parent’s first name and mission and reward names may be sent.
    • Support: answering your requests.
    • Improvement and measurement: understanding how the Service is used, finding errors and measuring campaigns — measurement and advertising tools run only according to your cookie choices.
    • Legal obligations: complying with the law and protecting our rights.

    We do not send you advertising without a separate, explicit consent. We do not sell personal information.

    4. Do you have to provide it?

    There is no legal obligation to give us information; it depends on your choice and consent. Without some details, however, we cannot provide the Service:

    • An email address (or Sign in with Google/Apple) — required to open an account.
    • A nickname and age — required to create a child profile.
    • Everything else — gaming platforms, "how did you hear about us", mission proof, notifications — is optional. Without it the Service keeps working, perhaps less personalised.

    5. Who we share it with

    Within the family: parents in the family see their children’s information, including proof. A child sees only their own profile.

    Providers that process data on our behalf — only to run the Service:

    • Supabase — database, authentication and file storage (including photos and voice recordings). Servers in the EU (Sweden).
    • Netlify — website hosting and delivery. US and a global server network.
    • Resend — sending email. US.
    • Google Firebase Cloud Messaging — app notifications. In the browser, notifications pass through the browser maker’s push service (Google, Apple, Mozilla). US.
    • Sentry — error monitoring. EU (Germany).
    • OpenAI — writing mission and reward ideas and reminders (see "How we use it"). US.
    • Anthropic — internal tools the GameTrust team uses for reports and drafting outreach. US.
    • PostHog — product analytics, including session recording when enabled, with typed input masked. US. Only with consent.
    • Google Analytics 4 and Google Ads — usage and campaign measurement. US. Only with consent.
    • Meta Pixel and TikTok Pixel (when enabled) — campaign measurement on Facebook, Instagram and TikTok. US and other countries. Only with consent.
    • Google and Apple — signing in with your account, and distributing the apps on Google Play and the App Store.
    • Google Fonts — the website’s fonts load from Google’s servers, so Google sees your browser’s IP address.

    Others: we disclose information to an authority only where the law requires it, and in a merger or sale of the business — to the entity that continues it, on the same terms and with advance notice.

    6. Storage outside Israel

    Information is stored and processed by the providers above, outside Israel — in the European Union and the United States. Transfers are made under the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to providers contractually bound to protect the data and use it only on our instructions.

    7. How long we keep it

    • While your account is active: account, family, child profiles, missions, proof and points.
    • In-app notifications: deleted automatically after 7 days.
    • When you delete your account: the parent account, the children’s profiles and activity, and the photos and voice recordings the children uploaded are deleted. Database backups roll over in the provider’s regular backup cycle.
    • Waitlist: kept until you ask to be removed.
    • Consent records and records the law requires us to keep: kept for as long as they are legally needed. Consent records (the versions accepted, the time, the IP address and a one-way hash of the email address) are kept after account deletion as legal evidence, without the account’s content.
    • Measurement data: kept by the measurement providers according to their retention settings.

    8. Your rights and how to use them

    • Access: receive the information we hold about you and your children (section 13 of the Protection of Privacy Law).
    • Correction and deletion: ask us to correct information that is wrong, incomplete or out of date, or to delete it (section 14).
    • Objecting to direct mail: ask us not to contact you with direct mail and to remove you from any mailing list (section 17F).
    • Withdrawing consent: change your cookie choices and turn off notifications at any time.

    How: in Settings → Privacy & Security you can export a copy of your data and delete your account. For anything else, write to office@redrockstudio.net. We reply within 30 days.

    Rights over children’s information are exercised by their parents. If you are not satisfied with our answer, you may contact the Israeli Privacy Protection Authority.

    9. Cookies and measurement

    Essential storage: the browser keeps data the Service cannot work without — your session, your child’s session, the language and display preferences. It is kept in the browser’s local storage and is not used for measurement.

    Measurement and advertising cookies: Google Analytics, Google Ads, PostHog, Meta Pixel and TikTok Pixel set their own cookies and identifiers. They load only if you allow them, and you can change your choice at any time:

    10. Children’s privacy

    • Children do not open accounts. Parents create the profile, choose what to provide and can delete it.
    • When adding a child, parents confirm that they are the child’s parents or legal guardians and agree to the collection of the child’s information under this policy.
    • No third-party measurement or advertising tools load on children’s screens, and no ads are shown.
    • Children’s photos and voice recordings are kept in private storage and open only for the parents in the family and the child.

    11. Security

    • All communication with the Service is encrypted (HTTPS).
    • Row Level Security in the database: each user reaches only their own family’s data.
    • Children’s photos and voice recordings are kept in private (non-public) storage and open only through a signed link that expires after one hour.
    • Children sign in with a signed, time-limited token; family-PIN guessing attempts are limited.
    • Passwords are handled by the authentication provider and are not stored by us in plain text.

    No system is perfectly secure. If a security incident occurs, we will act under the Protection of Privacy (Data Security) Regulations, 5777-2017, including reporting to the Privacy Protection Authority where the law requires.

    12. Changes to this policy

    We will update this policy when the Service or the law changes, and change the "Last updated" date at the top. We will give advance notice of a material change in the app or by email.

    See also the Terms of Use and the Accessibility Statement.